Linux Watch Command

watch runs a command at regular intervals and refreshes its output in the terminal window.

It is useful when you want to monitor output that changes over time, such as system uptime, disk usage, or active network connections.

This guide explains how to use the watch command in Linux with interval, highlighting, pipes, and practical monitoring examples.

How to Use the watch Command #

The syntax for the watch command is as follows:

watch [OPTIONS] COMMAND

To better illustrate how the watch command works, let us run the date command:

watch date

As you can see in the image above, the watch command will temporarily clear all of the terminal content and start running the provided command at regular intervals. When used without any option, watch will run the specified command every two seconds.

On the top left side of the screen header you can see the watch update interval and the executed command (Every 2.0s: date), while on the top right side watch shows the current time and date. If you want to turn off the header, use the -t (--no-title) option.

The output of the specified command is shown on the screen and regularly updated every two seconds.

To exit the watch command, press Ctrl+C. You can also set watch to exit when the output of the command changes by using the -g (--chgexit) option.

In the following sections, we will go over the most commonly used watch command options.

How to Change the Time Interval #

The default update interval is two seconds. The -n (--interval) option followed by the desired number of seconds allows you to change the time interval between updates:

watch -n INTERVAL_IN_SECONDS COMMAND

For example, to monitor your disk space usage with the df command and refresh the screen every five seconds, you would run:

watch -n 5 df -h

Highlighting the Difference Between Updates #

The -d (--difference) option will cause watch to highlight the changes between successive updates:

watch -d COMMAND

Let us say you want to monitor the system uptime by running the uptime command and highlight the changes. The command would be:

watch -d uptime

If you want the highlights to be sticky, pass =cumulative to the -d option. This means that all values that have ever changed will stay highlighted:

watch -d=cumulative COMMAND

Commands with Pipes #

If you want to execute a command that contains pipes, you need to enclose the command in single or double quotes. If you do not enclose the full command, watch will run just the first command and pipe its output to the next command in the pipeline.

watch 'COMMAND_1 | COMMAND_2'

For example, the following command will monitor the number of active connections on port 80 using a combination of the netstat and grep utilities:

watch "netstat -anp | grep -c ':80\b.*LISTEN'"

Running Complex Commands #

For commands that require shell features such as variables, subshells, or multiple statements, wrap the command in bash -c:

watch -n 2 bash -c 'echo "Load:"; uptime | awk -F"load average:" "{print \$2}"'

You can also use single quotes around the entire bash -c argument to avoid escaping:

watch -n 5 'df -h | grep /dev/sda'

Exiting Automatically #

By default, watch runs indefinitely until you press Ctrl+C. Two options let you exit automatically:

• -g (--chgexit) — exit when the command output changes.
• -e (--errexit) — freeze the display and exit with an error if the command returns a non-zero exit code.

For example, to watch a log file for a specific string and exit as soon as it appears:

watch -g grep -c "ERROR" /var/log/syslog

To monitor a command and stop immediately if it fails:

watch -e -n 5 systemctl is-active nginx

Quick Reference #

For a printable quick reference, see the watch cheatsheet .

Troubleshooting #

Command output is garbled or misaligned Some commands use terminal control codes that do not render correctly inside watch. Try adding --color flags or use a simpler output format. For commands that produce ANSI colour, pass --color to watch (available in newer versions).

watch: command not found Install the procps package: sudo apt install procps on Ubuntu/Debian or sudo dnf install procps-ng on Fedora/RHEL.

Piped command only runs the first part Enclose the entire piped command in quotes: watch 'cmd1 | cmd2'. Without quotes, the shell interprets the pipe before passing arguments to watch.

watch exits immediately with -e The monitored command returned a non-zero exit code on the first run. Verify the command works correctly on its own before using -e.

FAQ #

What is the default interval for watch? Two seconds. Use -n to change it: watch -n 10 command runs the command every 10 seconds. Fractional values are supported — watch -n 0.5 command updates twice per second.

How do I run a command every second with watch? Use watch -n 1 command. The -n option sets the refresh interval in seconds.

How do I run a watch command in the background? watch is an interactive terminal application and does not run well in the background. For background monitoring, use a cron job or a shell loop: while true; do command; sleep 5; done &.

How do I highlight only the changed parts of the output? Use watch -d command. Changed values are highlighted between each update. Add =cumulative to keep all ever-changed values highlighted: watch -d=cumulative command.

Can I use watch with shell aliases or functions? Not directly — watch does not inherit shell aliases or functions. Wrap the command in bash -c: watch bash -c 'your_alias_or_function'.

How do I exit watch automatically? Use -g to exit when the output changes, or -e to exit when the command fails. You can also set a time limit with -w SECONDS (available in some versions).

Conclusion #

The watch command is a simple but powerful tool for continuous monitoring directly in the terminal. Use -n to set the interval, -d to highlight changes, and quotes to handle pipes and complex commands. For scheduling tasks at intervals when you do not need a live display, consider using cron jobs instead.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page